release: v4.8.20 secure chat tools — completed, fixed and polished

Completes the messaging controls from v4.8.14 and fixes the bug that made them
appear broken for recipients.

Fixed:
- Per-message metadata was silently dropped for recipients. NotificationIntegration
  wrapped onMessage and deliverMessageToUI with 2-arg shims that called the
  originals without the 3rd argument (meta); with notifications enabled, view-once,
  disappearing timers and unsend all failed on the receiving side. Both wrappers
  now forward all arguments. Added tests/notification-meta-forwarding.test.mjs.
- Chat would not open after SAS: composer props were threaded into the wrong
  component (EnhancedConnectionSetup vs EnhancedChatInterface) -> ReferenceError
  nowTick on the verified re-render. Props moved to the chat component.

Changed:
- Code blocks: lightweight dependency-free syntax highlighting via React nodes
  (no innerHTML/remote scripts); code mode expands the input; copy auto-clears
  the clipboard after ~30s.
- View-once: configurable visible-after-open time (5s/15s/30s/1m) via meta.onceTtl.
- Disappearing timer: duration picker (Off/30s/5m/1h) instead of click-cycling.
- Composer toolbar moved next to "Send files"; borderless buttons, brand-orange
  active state; pickers open upward and are mobile-friendly.
- Sender bubble background lightened to rgba(249,115,22,0.05).

Removed:
- Panic wipe button (disconnect already wipes keys and clears session state).

Transport unchanged: per-message metadata travels inside the encrypted envelope,
whitelisted/bounded by _sanitizeMessageMeta. Full suite: 19 files, all passing.
Docs (README, CHANGELOG) updated; version bumped to 4.8.20.

src/network/EnhancedSecureWebRTCManager.js

@@ -6462,6 +6462,11 @@ async processOrderedPackets() {
         }
         if (meta.code === true) out.code = true;
         if (meta.once === true) out.once = true;
+        if (Number.isFinite(meta.onceTtl)) {
+            // View-once: seconds the message stays visible after the peer opens it.
+            const onceTtl = Math.floor(meta.onceTtl);
+            if (onceTtl >= 1 && onceTtl <= 3600) out.onceTtl = onceTtl;
+        }
         if (Number.isFinite(meta.ttl)) {
             // Clamp disappearing timer to [5s, 24h]; ignore anything else.
             const ttl = Math.floor(meta.ttl);
@@ -7847,10 +7852,19 @@ async processMessage(data) {
                             return; // IMPORTANT: Do not process further
                         }
                         
+                        // Per-message delete (unsend) from the peer.
+                        if (parsed.type === EnhancedSecureWebRTCManager.MESSAGE_TYPES.MESSAGE_DELETE) {
+                            const messageId = parsed?.data?.messageId ?? parsed?.messageId;
+                            if (typeof messageId === 'string' && messageId) {
+                                try { this.onMessageDelete?.(messageId.slice(0, 64)); } catch (_) {}
+                            }
+                            return;
+                        }
+
                         // ============================================
                         // SYSTEM MESSAGES (WITHOUT MUTEX)
                         // ============================================
-                        
+
                         if (parsed.type && ['heartbeat', 'verification', 'verification_response', 'verification_confirmed', 'verification_both_confirmed', 'sas_code', 'peer_disconnect', 'security_upgrade'].includes(parsed.type)) {
                             this.handleSystemMessage(parsed);
                             return;
@@ -7865,7 +7879,7 @@ async processMessage(data) {
                                 return;
                             }
                             if (this.onMessage) {
-                                this.deliverMessageToUI(parsed.data, 'received');
+                                this.deliverMessageToUI(parsed.data, 'received', parsed.meta);
                             }
                             return;
                         }
@@ -7994,7 +8008,7 @@ async processMessage(data) {
                     }
                     if (decryptedContent && decryptedContent.type === 'message' && typeof decryptedContent.data === 'string') {
                         if (this.onMessage) {
-                            this.deliverMessageToUI(decryptedContent.data, 'received');
+                            this.deliverMessageToUI(decryptedContent.data, 'received', decryptedContent.meta);
                         }
                         return;
                     }